WO2014087597A1 - Virus intrusion route identification device, virus intrusion route identification method and program - Google Patents

Virus intrusion route identification device, virus intrusion route identification method and program Download PDF

Info

Publication number
WO2014087597A1
WO2014087597A1 PCT/JP2013/006842 JP2013006842W WO2014087597A1 WO 2014087597 A1 WO2014087597 A1 WO 2014087597A1 JP 2013006842 W JP2013006842 W JP 2013006842W WO 2014087597 A1 WO2014087597 A1 WO 2014087597A1
Authority
WO
WIPO (PCT)
Prior art keywords
virus
operation history
file
process
intrusion route
Prior art date
Application number
PCT/JP2013/006842
Other languages
French (fr)
Japanese (ja)
Inventor
泰志 萩原
四柳 敬志
Original Assignee
キヤノン電子株式会社
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority to JP2012-268785 priority Critical
Priority to JP2012268785 priority
Application filed by キヤノン電子株式会社 filed Critical キヤノン電子株式会社
Publication of WO2014087597A1 publication Critical patent/WO2014087597A1/en

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/14Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441Countermeasures against malicious traffic
    • H04L63/145Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55Detecting local intrusion or implementing counter-measures
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55Detecting local intrusion or implementing counter-measures
    • G06F21/552Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55Detecting local intrusion or implementing counter-measures
    • G06F21/56Computer malware detection or handling, e.g. anti-virus arrangements
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55Detecting local intrusion or implementing counter-measures
    • G06F21/56Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/567Computer malware detection or handling, e.g. anti-virus arrangements using dedicated hardware
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/146Tracing the source of attacks
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/14Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425Traffic logging, e.g. anomaly detection

Abstract

This invention makes it possible to backtrace a virus infection route in more detail than in the past. The CPU (11) in client devices (10a, 10b) monitors each operation, and stores an operation history in a storage device (15). The CPU (11), upon detecting a virus, identifies from the operation history stored in the storage device (15) the date and time when the virus was first saved to the client device, and identifies the intrusion route of the virus based on the content of the operation executed at the identified date and time.

Description

Virus entry route identification device, virus entry route identification method and program

The present invention relates to a technology for identifying a route infected with a computer virus.

Computer viruses are becoming more and more sophisticated. In order to prevent computer virus infection, it is important to identify the infection route of computer virus. The task of tracing where the virus came from when a certain virus was found is called backtrace, and the task of predicting to which terminal the virus has been propagated is called forward trace. .

Patent Document 1 describes an invention relating to back trace. According to Patent Document 1, when the central apparatus detects a virus from a file transmitted from the terminal apparatus via the central apparatus, the date and time of registration of the vaccine, the date and time of last transmission of the file, and the current time of the file The date of transmission of the virus estimates the time of infection. In particular, if the date when the file was last transmitted is after the date when the vaccine was registered, the infection route is measured as other than the central unit, and if the date when the file was last transmitted is before the date when the vaccine was registered, the infection route Is identified as a central unit or other ISP.

Patent Document 2 describes an invention relating to forward tracing. According to Patent Document 2, when a virus is detected from a file at a client terminal, another client terminal that has accessed the file in the past may have already been infected with the virus A damage range prediction system identified as a terminal is disclosed.

Japanese Patent Application Laid-Open No. 2002-287991 JP, 2009-176132, A

According to Patent Document 1, it is possible to identify only two routes of infection, such as infection via the central apparatus and infection from other than that. However, the actual infection route is diverse. For example, files attached to e-mails may be infected with viruses, may be infected from removable media such as USB memory, or may be infected with files or scripts downloaded while browsing a website. Therefore, a specific infection route can not be identified only by the transmission date and time of the file. Further, in Patent Document 1, basically, the central apparatus detects a virus, a virus can not be detected for a file not passing through the central apparatus, and the infection route can not be identified. That is, the terminal device alone can not identify the infection route. Further, in Patent Document 1, since the focus is on only the transmission date and time of the file, the infection route can not be specified for the file that is not transmitted. As described above, the transmission history of the file can not identify the infection route only to the extent of completion via the central apparatus or infection via other routes.

Also, after a file is newly created, it is copied, overwritten, or renamed. In addition, although a virus may be detected from a temporary file generated by expanding a file attached to an email, a random file name may be given to the temporary file, and in such a case Also makes it difficult to identify the route of infection. Also, dedicated viewer software for viewing certain files may be called from a web browser by OLE (Object Linking and Embedding). In this case, if only the execution date of the viewer software is monitored, the virus infection route can not be identified sufficiently. That is, it is impossible to specify that the file has been acquired by the web browser.

According to Patent Document 2, when a virus is found at a client terminal, it is possible to identify another client terminal that may be infected with the same virus (this is called a forward trace). However, in Patent Document 2, it is not possible to execute, for the client terminal where the virus is first found, a backtrace for specifying where the virus originally came from.

An object of the present invention is, for example, to enable backtracking of a virus infection route in more detail than in the past by using operation history.

The present invention, for example,
What is claimed is: 1. A virus intrusion route specifying device that backtraces a virus intrusion route to a terminal device, comprising:
Operation history storage means for storing an operation history that is a history of an operation performed on the terminal device;
When a virus is detected in the terminal device, the date and time when the virus is first stored in the terminal device is specified from the operation history stored in the operation history storage means, and executed at the specified date and time And a means for specifying a virus entry route from the contents of the operation.

According to the present invention, by using the operation history, it is possible to backtrace the viral infection route in more detail than in the past.

Other features and advantages of the present invention will become apparent from the following description taken in conjunction with the accompanying drawings. In the attached drawings, the same or similar configurations are denoted by the same reference numerals.

The accompanying drawings are included in the specification, constitute a part thereof, show embodiments of the present invention, and are used together with the description to explain the principle of the present invention.
It is a figure which shows an example of a virus intrusion route search system. FIG. 6 is a block diagram showing functions implemented by a CPU or the like by executing various programs. It is a flowchart which shows the intrusion route search processing of a virus. It is a flowchart which shows the other example of the intrusion route search process of a virus. It is a flow chart which shows the example of the invasion route search processing of a virus. It is a figure which shows an example of a back trace when infected with a virus by web browsing. It is a figure which shows an example of a back trace when infected with a virus by a removable device. It is a figure which shows an example of a back trace when infected with a virus by the file sharing protocol. It is a figure which shows an example of a back trace when infected with a virus by mailer. It is a flow chart which shows an example of virus invasion course search processing (back trace). It is a figure which shows an example of the infection route of a virus. It is a figure which shows an example of the back trace based on operation log. It is a figure which shows an example of the infection route of a virus. It is a figure which shows an example of the back trace based on operation log. It is a flowchart which shows an example of a back trace. It is a figure which shows an example of the infection route of a virus. It is a figure which shows an example of the back trace based on operation log. It is a flowchart which shows an example of a back trace. It is a figure which shows an example of the infection route of a virus. It is a figure which shows an example of the back trace based on operation log. It is a flowchart which shows an example of a back trace. FIG. 7 is a diagram showing an example in which a plurality of backtrace results occur It is a flowchart which shows a weighting process. It is a detailed flow chart which shows weighting processing. It is a figure which shows an example of the back trace based on operation log.

<Basic way of thinking>
The following routes are generally considered as the entry route of computer virus.

(I) Infection from email attachments (identification of email sender)
(II) Infection from removable media (if it is a USB memory, its vendor ID
And identification of serial ID)
(III) Infection from website (specification of website URL)
(IV) Infection from file sharing network (specification of path name etc. in network)
In addition, as a factor of infection, the following can be considered, for example.

(A) Removable media (b) File execution (c) File copy / move (d) Website browsing (e) Script execution (f) OLE (Object Linking and Embedding)
(G) Vulnerability attack (h) Mailer (i) URL click (j) Webmail (k) Virus infection (l) File download (m) File save (n) Save as (o) Flash execution (o) p) There is decompression processing of ZIP (compressed file). Furthermore, the invasion route by the combination of these infectious agents can be subdivided as follows.

(1) Execute the file stored in the removable media (a => b)
(2) Copy files stored on removable media (a => c)
(3) Extract the ZIP file stored on the removable media (a => q)
(4) Copy the file locally and execute it (c => b)
(5) Unzip the ZIP file locally and execute the created file (q => b)
(6) Copy the file created by extracting the ZIP file locally (q => b)
(7) Web site browsing by executing files (b => d)
(8) Browse the website and execute the script (d => e)
(9) Execute file and call OLE (b => f)
(10) Execution of file by OLE (f => b)
(11) Script execution vulnerability attack (e => h)
(12) File execution vulnerability attack (b => h)
(13) File download by web browsing (d => m)
(14) Click attached URL by executing mailer (i => j)
(15) Download file via web mail (k => m)
(16) Click on attached URL by web mail (k => j)
(17) Download file by mailer (i => m)
(18) Virus infection due to vulnerability attack (h => l)
(19) Browsing the website by clicking on the attached URL (j => d)
(20) Save the file and execute it (n => b)
(21) Name and save the file and execute it (o => b)
(22) Download the file and execute it (m => b)
(23) Download the file and save it (m => n)
(24) Download the file and save it as a name (m => o)
(25) Flash execution by web browsing (d => p)
(26) Vulnerability execution by execution of flash (p => h)
(27) Mail forwarding (i => i)
The actual invasion route is further combined into these multiple. For example, browsing the website, downloading the file (ZIP), saving the downloaded file (ZIP), extracting the saved file (ZIP), executing the extracted file, vulnerability attack, and virus infection (d => The route is m => n => q => b => h => l). Also, as a completion route starting from mail, for example, execution of mailer, download of attached file, storage of attached file, execution of stored file, vulnerability attack, and virus infection (i => m => n = It becomes a route such as> b => h => l). An intrusion path from removable media such as a USB memory is, for example, a path such as removable media, file copy, file execution, vulnerability attack, and virus infection (a => c => b => h => l). In the case of infection from a file sharing network, this is a route such as copying of files, execution of files, vulnerability attack, and virus infection (c => b => h => l). Virus detection software searches for virus-specific code to find a file infected with a virus, and identifies the process name (process path name) and process ID of the process that attempted to execute the file. Therefore, by searching the operation history using the process path name and the process ID as a search key, it is possible to specify what route the infected file has been created in the terminal, that is, the intrusion route.

The operation history records the contents of the operation performed by the user on the terminal device, the date and time of operation, and the like. As the contents of operation, the URL of the website, the path name of the downloaded file, the path name of the uploaded file, and the like are recorded as those related to web browsing. The contents of the operation related to file operation include the path name of the file targeted for operation (path name of copy source, path name of copy destination), type of operation (file open, name change, deletion, new creation, overwrite save, name And save. The contents of the operation relating to the removable media are connection / removal of the removable device, device name, device ID, vendor ID, serial ID, and the like. The contents of operations related to the mailer include the distinction between transmission and reception, the presence or absence of an attached file, the transmission destination, the e-mail address of the transmission source, the subject, the message ID and the like. The contents of operations related to FTP include file upload, file download, file deletion and the like. The contents of operations related to the active window include URL access, active window, window title change, save as dialog and the like.

In order to search for an intrusion route from the operation history, for example, a path name, a process name, a process ID, etc. are at the center of the inspection key. For example, suppose a virus is detected when trying to execute a file. In this case, the path name of the file, the name of the process attempting to execute the file, the process ID, etc. are specified by the virus detection software. The intrusion route search unit for searching the virus intrusion route searches the operation history using these as search keys, and finds records matching the search keys. When arranging the records according to the creation date of the found record, the intrusion route search unit specifies the name of the process which saved the detected file of the virus first and the path name of the file at that time. For example, when the file is first stored in the terminal device, if the process involved in the storage is a mailer, it is known that the virus has been infected via mail. Also, if the process is a web browser, it is known that the virus has been infected via the web. Also, if the process is a file manager and the copy source path name is a removable device, it is known that the virus has been infected via the removable device. Also, if \\\ is attached to the path name, it is known that the virus was infected from the file server shared by the file sharing protocol. Also, “save” is a concept including creation of new files and overwrite saving.

In addition, if OLE is involved, it will be possible to identify a more detailed virus entry route by specifying from the operation history the parent process that has called the process by OLE.

By the way, part or all of the operation history may be transferred to the server on the network, and the terminal device may not have a sufficient operation history. In this case, there is a possibility that the virus entry route can not be sufficiently identified. Therefore, in this case, the terminal device requests the server to request backtrace of the intrusion route. The server device also includes an intrusion route search unit similar to that of the terminal device, and holds operation histories of a plurality of terminal devices in a database. As described above, the terminal device may cooperate with the server device to trace the past operation history and specify the virus intrusion route. In addition, by applying the fact that the operation history of a plurality of terminal devices is stored in the server device, an intrusion route may be specified across the plurality of terminal devices.

<Example>
FIG. 1 is a diagram showing an example of a virus intrusion route search system including client devices 10a and 10b (hereinafter simply referred to as client device 10) and a server device 20 that collects operation history. Although the server device 20 is not essential to the present invention, it is shown in FIG. 1 because the server device 20 is required in some embodiments. The client device 10 is an example of a computer that is installed in, for example, a company, a school, an administration, a home, or the like and acquires a user's business history (operation history or browsing history). The client device 10 is not limited to a personal computer, and may be a scanner device, a multifunction device, a digital camera, or a portable terminal device. The server device 20 is a computer that acquires operation history from a plurality of client devices 10, converts it into a database, and searches a virus intrusion route. The server device 20 is optional and is not necessarily required. The client device 10 is connected to a server device 20, a web server, an FTP server, a mail server, and the like via a network 100 such as the Internet or an intranet.

The client device 10 is an information processing device (terminal device) such as a personal computer disposed in an office (a company, a school and an administrative organization) or a home. In the client device 10, the CPU 11 functions as various means in accordance with the software stored in the storage device 15. The storage device 15 is a hard disk drive (HDD) or an SSD. The memory 13 includes a RAM, a ROM, and the like. The ROM stores a boot program such as a BIOS. An operating system (OS) is activated according to the boot program, and various resident programs (agent service, virus detection program, virus intrusion route search program, etc.) are activated according to the OS. The RAM functions as a work area. The network interface 14 is a communication circuit for communicating with another computer through the network 100. The CPU 11 and the network interface 14 function as receiving means for receiving information from the server device and transmitting means for transmitting information to the server device. The storage device 15 stores not only the Web browser and the mailer, but also the OS, an agent service, a virus detection program, a virus intrusion route search program, an operation history database, and the like. The agent service is a program in charge of monitoring and recording operation history. As an OS, Windows (registered trademark) will be described as an example, but Mac OS, Linux (registered trademark), iOS, Android, or the like may be used. The input unit 16 is a pointing device (mouse or touch panel) or a keyboard. The keyboard may be a software keyboard. In addition, the input unit 16 may be a voice recognition input unit that recognizes an input voice of the operator with a voice recognition function and inputs an instruction to the CPU 11. The display device 12 is a user interface for displaying information. The external interface 17 is a USB interface or the like, and connects the removable device 18. The removable device 18 is, for example, a USB memory recognized as a storage class.

The storage device 25 of the server device 20 is a hard disk drive (HDD), an SSD, or the like, and stores a server program. The memory 23 includes a RAM, a ROM, and the like. The CPU 21 loads a server program into the RAM, acquires operation history data from a plurality of client apparatuses 10, and converts it into a database or searches for a virus intrusion route. The network interface 24 is a communication circuit for communicating with other computers through the network 100. The display device 12 is a user interface for displaying information.

FIG. 2 is a block diagram showing functions implemented by a CPU or the like by executing various programs. The agent service 201 of the client device 10 sets setting information set from the management unit 225 of the server device 20 in the virus intrusion route searching unit 202, monitors user operations and records operation history in the database 204. Or acquiring a search result of the virus intrusion route searching unit 202 or transmitting a request for requesting the server device 20 to search for a virus intrusion route. When the virus intrusion route searching unit 202 acquires virus information (pathname of infected file, virus name, process pathname associated with virus, etc.) from the virus detection unit 203, the virus intrusion route is backed up based on the operation history. Trace. The virus detection unit 203 detects a known virus or an unknown virus based on the virus definition file. In the operation history database 204, various operation contents executed by the user on the client device 10, operation date and time, and the like are recorded as operation history. The agent service 201 may transfer part or all of the operation history to the server device 20 at a predetermined timing, and delete the transferred operation history. The agent service 201 of the client device 10, the virus intrusion route searching unit 202, the virus detecting unit 203, and part or all of the database 204 may be realized by a thin client (for example, a terminal service). The terminal service is a service that enables a client computer to remotely connect to a server computer and execute an application program on the server computer using a virtual desktop environment generated on the server computer. At this time, a plurality of users can simultaneously log in to a service provided by the server computer using their respective user accounts and use the virtual desktop environment.

The server device 20 includes a virus intrusion route searching unit 222 having the same function as the virus intrusion route searching unit 202 of the client device 10. When the virus intrusion route search unit 222 receives a search request for a virus intrusion route through the information acquisition unit 223, the virus intrusion route search unit 222 searches the operation history of the client apparatus as a search target, and identifies the virus intrusion route. The search result is displayed on the display device 22 by the viewer 211 or transmitted to the client device 10. The log processing unit 221 writes the operation history transferred by the agent service 201 into the operation history database 224. As compared with the operation history database 204 of the client device 10, the operation history database 224 of the server device 20 stores data of operation history over a long period of time. The information acquisition unit 223 takes charge of transmission and reception of data with the client device 10, and the like. When receiving the search request from the agent service 201, the information acquisition unit 223 passes the request to the virus intrusion route search unit 222. Further, when receiving the operation history from the agent service 201, the information acquisition unit 223 passes it to the log processing unit 221. For example, these communication processes are performed by HTTP communication. When the information acquisition unit 223 receives the result of the backtrace from the virus intrusion route search unit 222, the information acquisition unit 223 transmits the result to the client device 10 that has transmitted the request. The log processing unit 221 writes the operation history received from the client device 10 in the operation history database 224. The viewer 211 causes the display device 22 to display the backtrace result received from the virus intrusion route searching unit 222. The management unit 225 performs various settings on the agent service 201 (such as an operation history recording target and an operation history retention period setting).

FIG. 3 is a flowchart showing a virus intrusion route search process executed by the CPU 11 of the client device 10.

In S301, the CPU 11 activates an agent service program, a virus detection program, an intrusion route search program, and the like according to the OS. Thus, the agent service 201, the virus intrusion route searching unit 202, the virus detecting unit 203, and the like start operations.

In S302, the CPU 11 determines whether the virus detection unit 203 has detected a virus. If the virus detection unit 203 notifies the CPU 11 (virus intrusion route search unit 202) that a virus has been detected, the process advances to step S303. The virus detection unit 203 notifies the CPU 11 (virus intrusion route search unit 202) of information such as a process path name of a process related to a virus, a detection date and time, and a process ID (this is called virus detection information). The CPU 11 (virus intrusion route searching unit 202) may recognize that a virus is detected by searching a virus detection log created by the virus detection unit 203. In this case, there is an advantage that the present invention can be applied even to a virus detection program which is not supposed to cooperate with the intrusion route search program.

In step S303, the CPU 11 (virus intrusion route searching unit 202) searches the operation history database 204 according to the search key included in the virus detection information. As a result, it is possible to identify the date and time when the file or process related to the virus was first created on the client device 10 and the intrusion route. Details of such back trace will be described later.

In S304, the CPU 11 (virus intrusion route searching unit 202) transmits the backtrace result to the server device 20 through the agent service 201. When the server device 20 receives the result of the backtrace through the information acquisition unit 223, the server device 20 causes the display device 22 to display the result of the backtrace by means of the viewer 211. This enables the system administrator to easily grasp the virus entry route.

As described above, if there is no operation history in the client device 10 or only a part of the operation history remains, backtrace may fail. Therefore, in the present invention, an example in which the client device 10 and the server device 20 cooperate to execute the backtrace by requesting the server device 20 for the backtrace will be described.

FIG. 4 is a flowchart showing another example of the virus intrusion route search process executed by the CPU 11 of the client device 10. Descriptions will be omitted by giving the same reference numerals to the processing already described. Here, after S301 to S303 are performed, the process proceeds to S401.

In S401, the CPU 11 (virus intrusion route searching unit 202) determines whether or not backtrace has failed. For example, the CPU 11 failed to backtrace when no record was found recording the path name of the process related to the virus, or no record could be identified from the record even if the record was found. It is determined that If the backtrace fails, the process proceeds to S402.

In S402, the CPU 11 (virus intrusion route searching unit 202) transmits a request for requesting a backtrace to the server device 20 through the agent service 201. At this time, the CPU 11 also transmits, to the server device 20, virus detection information necessary to execute the backtrace, identification information (network address and computer name) for specifying the client device 10, and the like.

In S403, the CPU 11 (virus intrusion route searching unit 202) receives the backtrace execution result from the server device 20 through the agent service 201. The CPU 11 may display the result of backtrace execution on the display device 12. This allows the user to understand the virus entry route.

On the other hand, if it is determined in S401 that the backtrace has succeeded, the process proceeds to S404. In S404, the CPU 11 (virus intrusion route searching unit 202) transmits the backtrace result to the server device 20 through the agent service 201. When the server device 20 receives the result of the backtrace through the information acquisition unit 223, the server device 20 causes the display device 22 to display the result of the backtrace by means of the viewer 211.

FIG. 5 is a flowchart showing an example of virus intrusion route search processing executed by the CPU 21 of the server device 20.

In step S501, the CPU 21 (virus intrusion route search unit 222) determines, through the information acquisition unit 223, whether a request for requesting execution of backtrace has been received. If the said request is received, it will progress to S502.

In S502, the CPU 21 (virus intrusion route searching unit 222) executes backtrace. For example, the CPU 21 accesses the operation history database 224 using the virus detection information received from the client device 10 and the identification information for identifying the client device 10 as a search key, and executes the search. Then, the date and time when the file associated with the virus was first created in the client device 10 and the intrusion route (for example, web browsing, mailer, removable device, file sharing protocol) are specified from the found record.

In step S503, the CPU 21 (virus intrusion route search unit 222) causes the viewer 211 to display the backtrace result or transmits the backtrace result to the client device 10.

<Backtrace Details>
FIG. 6 shows an example of backtrace when infected with a virus by web browsing. Here, an example in which the backtrace is executed from the content of the operation stored in the operation history 600 will be described. The operation history 600 includes, for example, an operation name 601, a file name 602, a process name 603, an attached file name 604, a URL 605, an operation date 606, and the like. The URL 605 may be specified from the access log of the network, or may be determined from the window name (title name) / address bar name of the active window of the target process. Note that depending on the process, a certain process (parent program) may be used as a basis to generate some program (child program). In that case, the URL 605 may be determined from the parent program / child program window name (title name) / address bar name. When the virus detection unit 203 detects a virus, the process name (example: Malware. Exe), the process ID and the like are passed from the virus detection unit 203 to the virus intrusion route searching unit 202. The virus intrusion route search unit 202 searches the operation history 600 using the process name (example: Malware. Exe) and the process ID as search keys, and backtraces the route in order from the new operation content of date and time. In this example, it can be seen that the virus (Malware.exe) is performing web access. Furthermore, the virus intrusion route searching unit 202 traces back the past operation history. In this example, it can be seen that the virus (Malware.exe) was saved at 13:05:30 on November 20, 2012. The process name 603 and the file name 602 may be path names including paths. This is because backtrace can be performed more accurately. Furthermore, the virus intrusion route searching unit 202 traces back the operation history in the past, and the virus (Malware.exe) is webbrowser. Use exe to find out that it has been downloaded from a site (http://www.jp). File download is an example of an operation in which a virus (Malware. Exe) first intruded into the client device 10. Thus, the timing at which the virus (Malware. Exe) first invades the client device 10 can be determined from the operation name 601.

FIG. 7 shows an example of backtrace when a virus is infected by a removable device. In this example, copy source information 701 indicating a file copy source is added to the operation history 600. As described above, the virus intrusion route searching unit 202 traces the past operation history according to the process name, and finds “file copy” which is the operation involved in the first intrusion as the operation name. Copy source information 701 in the found record indicates that the removable device is the copy source. Therefore, the virus intrusion route searching unit 202 specifies that the virus (Malware. Exe) intrusion route is a removable device. Note that if the removable device product ID, vendor ID, serial ID, and the like are recorded in the record of the operation history 600, it is possible to specifically identify which removable device.

FIG. 8 shows an example of backtrace when infected with a virus by the file sharing protocol. As described above, the virus intrusion route searching unit 202 traces the past operation history according to the process name, and finds “file copy” which is the operation involved in the first intrusion as the operation name. The copy source information 701 in the found record contains a path name indicating the copy source, but the path name includes “¥¥” indicating the copy from the network drive. Thus, the virus intrusion route searching unit 202 specifies that the virus (Malware. Exe) intrusion route is a network drive (file sharing protocol).

FIG. 9 shows an example of backtrace when infected with a virus by mailer. The virus intrusion route searching unit 202 traces back the past operation history according to the process name, and finds “newly created” which is an operation suspected of being involved in the first intrusion as the operation name. However, the process that newly created the file of the virus (Malware.exe) is an OLE-related process (eg Reader.exe), and this process may have been called by another process (parent process) . Therefore, the virus intrusion route searching unit 202 searches for operation contents close in date and time by this other process, and finds operation contents such as “file open”. That is, the virus (Malware.exe) is ABCD. pdf to Reader. When exe opens, the Reader. It turns out that it is a virus that was generated by exploiting the exe vulnerability. The virus intrusion route searching unit 202 newly searches for the date and time when the file name (ABCD. Pdf) was first saved and the operation content. As a result, the virus intrusion route searching unit 202 causes the file (ABCD. Pdf) attached to the mail received from the mail address (a@b.c.jp) by the mailer (Mailer.exe) to be the intrusion route. It can be identified that it was.

In this way, for a process that may be called from the parent process by OLE by the process used to open the file, the process name is registered in the table in advance, and the process name is found by search from the operation history. When this happens, it is possible to find the true entry point by searching the operation history for the parent process that has called the process.

FIG. 10 is a flowchart showing an example of virus intrusion route search processing (back trace).

In step S1001, the virus intrusion route searching unit 202 searches the operation history based on the virus information (eg, process name and the like) received from the virus detection unit 203.

In S1002, the virus intrusion route searching unit 202 sorts the records found by the search in the order of operation date and time recorded therein. The sorting process may be omitted.

In step S1003, the virus intrusion route search unit 202 checks old records in order from a new record, and the file name recorded in the record is an intrusion related operation (eg, mail reception, web browsing, download, new file creation, removable) Determine whether the file is copied / moved from the device, copied / moved by file sharing protocol, etc.). If the operation name is not an intrusion related operation, the process proceeds to S1004. If the operation name is an intrusion-related operation, the process advances to step S1006. In S1006, the virus intrusion route searching unit 202 extracts necessary information from the record involved in the found virus intrusion, and creates a search result.

In step S1004, the virus intrusion route searching unit 202 searches for a new record next to the record for which the investigation has just ended, among a plurality of records found by the search.

In S1005, if there is no new record next, the virus intrusion route searching unit 202 aborts the back trace there and proceeds to S1006. In S1006, the virus intrusion route searching unit 202 compiles, as a search result, the movement route (file copy, movement, etc.) of the virus found before the backtrace is aborted. On the other hand, if there is a new record next, the process returns to S1003, and the virus intrusion route searching unit 202 checks the file name etc. recorded in the next new record.

In the intrusion-related operation determination process of S1003, as illustrated in FIG. 9, the backtrace is continued in consideration of the relationship between the parent-child process and the file renaming.

The backtrace executed by the server device 20 is basically the procedure shown in FIG. When the virus intrusion route searching unit 222 of the server device 20 creates a search result, it also reflects the search result received from the client device 10 to create a search result as a whole. For example, when the client apparatus 10 searches from October 11, 2013 to September 11, 2013, and the server apparatus 20 searches from September 10, 2013 to September 11, 2012, the server apparatus 20 Create backtrace results from October 11, 2013 to September 11, 2012 as search results.

As described above, according to this embodiment, by storing the operation history in advance, it is possible to backtrace the intrusion route and the movement route of the virus by searching the operation history. The virus intrusion route search unit may be present only in the terminal device, may be present only in the server device, or may be present in both. If the virus intrusion route search unit is provided only in the terminal device, the virus intrusion route can be searched relatively easily. Providing the virus intrusion route search unit only in the server device has the advantage of reducing the search load on the terminal device. Furthermore, if the virus intrusion route search unit is provided in both the terminal device and the server device, even if the intrusion route can be specified only halfway through the terminal device, it will be possible to identify the first intrusion opening in the server device. . Also, virus entry ports can be classified into several types. Therefore, an intrusion may be specified by executing backtrace until a specific operation content that can be said to be an intrusion operation appears. That is, if a specific operation content is not found even if the back trace is performed and the operation history is traced back, it can be determined that the search has failed. Also, as a result, the server apparatus may be requested to search.

It should be noted that even if the entry is found at first glance, if the operation is an operation performed by a child process, it may be possible to find a true entry by further specifying the parent process.

<Others>
According to the above-described embodiment, it is possible to specify an intrusion through which a virus has invaded a certain client device 10. By the way, when the virus is infected by copying a file from a file server by a file sharing protocol in a network, the problem is who uploaded the file. On the other hand, the server device 20 holds the operation history of each of the plurality of client devices 10 under its control. Therefore, if the file name (path name) infected with the virus and the operation date are known, the server device 20 can specify another client device 10 that uploaded (copied) the file to the file server. Furthermore, the server device 20 can also specify from the operation history how the file has been operated (copied, renamed, downloaded, stored) in the other client device 10. Therefore, the virus intrusion route searching unit 222 of the server device 20 can also specify the virus intrusion route into the domain sharing the file by the file sharing protocol.

In the embodiment described above, it is assumed that the virus intrusion route searching unit 202 is present in the client device 10, but the virus intrusion route searching unit 222 may be present only in the server device 20. In this case, the agent service 201 may transfer all the operation history to the server device 20, and may further transmit the virus detection information from the virus detection unit 203 to the server device 20 together with the search request.

Further, the virus detection unit 203 can detect a script type virus, a virus stored in a registry, and a virus expanded on a memory. Therefore, the virus intrusion route search unit 202 identifies from the operation history the process that executed the script, the process that wrote the virus code to the registry, the process that deployed the virus on the memory, and the URL of the site that made the script downloaded Or, the source of the file containing the virus code written to the registry, and the route of entry of the virus-deployed process on the memory may be specified.

● [Back trace when file or program is executed via network]
As illustrated in FIG. 11, a plurality of client devices 10a, 10b, 10c, and 10d are connected to the network 100 in the Internet, an intranet, or the like. The client device 10a has a folder 1101 to which access is permitted by, for example, SMB. The pathname of the folder 1101 is, for example, \\ CleientA. The folder 1101 stores an arbitrary file (here, Malware. Pdf). The client apparatuses 10b and 10c access the folder, and file operations such as opening and copying the file are permitted. Under such a premise, when the client apparatuses 10 b and 10 c manipulate files in the folder 1101 by the process (Viewer.exe), the virus detection unit 203 detects a virus. In such a case, it is specified that the virus entry route is another terminal device. In the following description, “Client A” will be described as an example of identification information of the client device 10 a, “Client B” as an example of identification information of the client device 10 b, and “Client C” as an example of identification information of the client device 10 c.

FIG. 12 shows an example of the back trace. The operation history 600 includes a PC name 1200 which is identification information of the client apparatus which has performed the operation, and a process ID which is process identification information.

(I) When the virus detection unit 203 detects a virus, the virus intrusion route search unit 202 acquires, from the virus detection information, process identification information (process name 603 and process ID 1201) of the process for which the association with the virus is pointed out. . Furthermore, the virus intrusion route searching unit 202 searches the operation history 600 according to the process identification information, and finds a record of the operation history that the process has started.

(Ii) The virus intrusion route searching unit 202 is a record having common process identification information, a record of an operation history indicating that the process has opened any file from the time when the process started to the time when the virus is detected Identify

(Iii) The virus intrusion route searching unit 202 acquires the path name of the file included in the found record. The virus intrusion route searching unit 202 recognizes that the file is shared by the network because the acquired path name contains “¥¥”, and further, the client device “Client A” in the path name Since the identification information of 10a is included, the client device 10a is specified as the virus intrusion route to the client device 10b.

The virus intrusion route searching unit 202 may pass the found path name to the virus intrusion route searching unit 222 of the server device, and the virus intrusion route searching unit 222 of the server device may further specify the intrusion route. In the operation history database 224 of the server device 20, operation histories of a plurality of terminals are recorded. Thus, the virus intrusion route searching unit 222 can trace the movement of files among a plurality of client devices. When the virus intrusion route searching unit 222 receives a request from the virus intrusion route searching unit 202, the virus intrusion route searching unit 222 backtraces the process of writing the file in the folder 1101 according to the request (path name). In this way, it is possible to identify the route of entry of the virus into the client device 10a.

As described above, the operation history database 224 provided in the server device 20 stores the operation history acquired in the plurality of terminal devices, and the virus intrusion route searching unit 222 provided in the server device 20 includes the plurality of operation history databases. When a virus is found in one of the terminal devices, the operation history of a plurality of terminal devices is searched based on the path name or process identification information associated with the virus, and the entry route of the virus is identified. Do.

FIG. 13 shows a case where a virus is detected in the client device by executing files stored in the network folder. Here, it is assumed that the file "Malware.exe" in question is stored in the folder 1101 of the client device 10a, and the other client devices 10b and 10c have executed it.

FIG. 14 shows an example of the back trace.

(I) When the virus detection unit 203 of the client device 10b detects a virus, the virus intrusion route search unit 202 determines the process identification information (process name 603 and process ID 1201) of the process whose association with the virus is pointed out from the virus detection information. Get). In FIG. 14, in the process name 603, a path name "\\ ClientA \\\ Malware.exe" is stored. Furthermore, the virus intrusion route searching unit 202 searches the operation history 600 according to the process identification information, and finds a record of the operation history that the process has started.

(Ii) The virus intrusion route searching unit 202 is a record having common process identification information, a record of an operation history indicating that the process has opened any file from the time when the process started to the time when the virus is detected Identify In the example shown in FIG. 14, although there is a record indicating that another process has opened the text file, the virus-related process (\\ ClientA \\ Malware.exe) is executing any file operation. Absent. Therefore, the virus intrusion route searching unit 202 identifies the process (¥ \ ClientA ¥ \ Malware.exe) itself as a virus and identifies the client apparatus 10a as an intrusion from the path name.

Here, although the client device 10 has been described as specifying the intrusion route, as described above, the intrusion route may be specified only by the server device 20, and the virus intrusion route searching unit 202 of the client device 10 The virus intrusion route search unit 222 of the server device 20 may cooperate with each other to execute the virus intrusion route identification process. The operation history storage means provided in the server device 20 stores an operation history that is longer than the period of the operation history stored in the operation history storage means provided in the client device 10. Therefore, the client device 10 may request the server device 20 to backtrace the past operation history only when the intrusion path can be specified only halfway through the operation history stored in itself. The server device 20 searches the past operation history according to the request received from the client device 10.

FIG. 15 is a flowchart showing the backtrace procedure executed by the server device. The backtrace is described as being executed by the client device 10, but part or all may be executed by the server device 20.

In step S1501, the virus intrusion route searching unit 202 determines whether the virus detection unit 203 of the client device 10 detects a virus. (When the virus intrusion route searching unit 222 of the server device 20 executes the backtrace, when the virus detecting unit 203 detects a virus, the agent service 201 of the client device 10 detects that the virus is detected. ) And if a virus is detected, proceed to S1502.

In S1502, the virus intrusion route searching unit 202 acquires the above-described virus detection information from the virus detection unit 203 of the client device 10.

In step S1503, the virus intrusion route searching unit 202 causes the operation history 600 stored in the operation history database 204 to determine whether the process specified by the process identification information included in the virus detection information has opened a file. Therefore, it judges. When the server device 20 executes the backtrace, the virus intrusion route searching unit 222 may instruct each client device 10 to transfer the operation history to the server device 20. This makes it possible to search for the latest operation history. If the file is open, the process advances to step S1504.

In step S1504, the virus intrusion route searching unit 202 determines whether the file path of the opened file starts with a specific symbol "¥" indicating that the file is a network shared file. If the file path starts with the symbol “¥”, the process advances to step S1505.

In step S1505, the virus intrusion route searching unit 202 recognizes that the file associated with the virus exists on the network.

In step S1506, the virus intrusion route searching unit 202 identifies the client device that holds the virus from the path name of the file associated with the virus.

In step S1507, the virus intrusion route searching unit 202 determines whether to further search the operation history of the client device holding the virus. For example, if the client device holding the virus is itself, the virus intrusion route searching unit 202 needs to search the database 204 further in the past. In this case, the virus intrusion route searching unit 202 searches the database 204 further back in the past. On the other hand, if the client device holding the virus is another terminal, the virus intrusion route searching unit 202 can not execute a further search, so it is necessary to request the server device 20 to search. Further, when the virus intrusion route searching unit 202 searches the database 204 further back in the past, the operation history may be insufficient. In this case, the process proceeds to S1508.

In step S1508, the virus intrusion route searching unit 202 requests the server device 20 to search through the agent service 201. This request includes identification information of another client apparatus to be searched, a path name of a file, and the like. The virus intrusion route searching unit 222 of the server device 20 specifies an intrusion route according to the request.

● [Backtrace in case virus file is attached to email, email recipient transfers to another person without opening file, and virus gets infected at forwarding destination]
FIG. 16 shows the case of virus infection by mail transfer. When a virus is attached to a mail, the virus is detected by the virus detection unit 203 when the attached file is executed. Therefore, even if the e-mail is received, there is a possibility that the virus may not be detected if the attached file is transferred as it is without operating.

According to FIG. 16, it is assumed that the client device 10c receives an e-mail from an external sender and transfers the e-mail to the client device 10b without operating the attached file. Further, it is assumed that the client device 10b also transfers the mail to the client device 10a without operating the attached file. It is assumed that the client device 10a unfortunately executes the attached file of the mail and detects a virus. In this case, the client device 10a can specify that the client device 10b is the intrusion route according to the above-mentioned procedure, but can not specify the intrusion route from there.

On the other hand, the server device 20 also stores the operation of the mailers of the plurality of client devices 10a to 10d as an operation history. Therefore, the virus intrusion route searching unit 222 of the server device 20 can backtrace a more detailed intrusion route using the database 224.

FIG. 17 shows an example of backtrace of the virus intrusion route in which mail transfer is involved. Here, it is assumed that the virus intrusion route searching unit 222 of the server device 20 executes backtrace.

(I) The virus detection unit 203 detects a virus, and passes the process name 603 and process ID 1201 associated with the virus to the virus intrusion route searching unit 222 via the virus intrusion route searching unit 202 and the agent service 201. The agent service 201 also passes the PC name to the virus intrusion route searching unit 222. Based on the process name 603, the process ID 1201 and the PC name associated with the virus contained in the virus detection information, the virus intrusion route searching unit 222 finds an operation history when the process starts from the database 224.

(Ii) When the virus intrusion route searching unit 222 finds the operation history when the process starts, the operation history recorded when the new executable file is newly created from the path name of the executable file of the process is further stored in the database 224. Find from Here, it can be seen that the mailer created an executable file (Malware.exe) related to the virus.

(Iii) The virus intrusion route searching unit 222 searches and extracts an operation history when the mailer receives the executable file (Malware. Exe) as an attached file. Furthermore, the virus intrusion route searching unit 222 specifies the other client device 10b that has transmitted the mail by extracting the sender mail address 1701 recorded in the record of the found operation history.

Note that (i) to (iii) may be executed in the client device 10a that has detected a virus.

(Iv) Based on the sender email address 1701 and the attached file name 604, the virus intrusion route searching unit 222 searches the database 224 for a record of operation history indicating that the attached file in question has been received, and extracts it. The virus intrusion route searching unit 222 extracts the sender e-mail address 1701 contained in the record, thereby specifying the other client device 10c that has sent the e-mail.

(V) Based on the sender email address 1701 and the attached file name 604, the virus intrusion route searching unit 222 searches the database 224 for a record of operation history indicating that the attached file in question has been received and extracts it. The virus intrusion route searching unit 222 specifies the external sender (unknown@maiware.jp) that has sent the mail by extracting the sender mail address 1701 included in the record. The first entry into the management of the server device 20 is identified as the client device 10c.

Also, the virus intrusion route search unit 222 not only specifies the sender of the mail based on the operation history when the mailer receives the executable file (Malware. Exe) as an attached file, but the mailer newly creates the executable file The sender of the mail may be specified based on the mail information (mail open log) opened immediately before the mailer.

FIG. 25 shows another example of the backtrace on the virus intrusion route in which mail transfer is involved. Here, it is assumed that the virus intrusion route searching unit 222 of the server device 20 executes backtrace.

(I) The virus detection unit 203 detects a virus, and passes the process name 603 and process ID 1201 associated with the virus to the virus intrusion route searching unit 222 via the virus intrusion route searching unit 202 and the agent service 201. The agent service 201 passes the PC name as virus detection information to the virus intrusion route searching unit 222 in addition to the above information. Based on the process name 603, the process ID 1201 and the PC name associated with the virus contained in the virus detection information, the virus intrusion route searching unit 222 finds an operation history when the process starts from the database 224.

(Ii) When the virus intrusion route searching unit 222 finds the operation history when the process starts, the operation history recorded when the new executable file is newly created from the path name of the executable file of the process is further stored in the database 224. Find from Here, it can be seen that the mailer created an executable file (Malware.exe) related to the virus.

(Iii-i) The virus intrusion route searching unit 222 searches and extracts the operation history when the mailer receives the executable file (Malware. Exe) as an attached file. Furthermore, the virus intrusion route searching unit 222 specifies the other client device 10b that has transmitted the mail by extracting the sender mail address 1701 recorded in the record of the found operation history.

Also, another client apparatus 10b that has transmitted the target mail via the route of (iii-ii) instead of (iii-i) may be specified.

(Iii-ii) The virus intrusion route search unit 222 extracts email information (open log of email) of the email opened by the target mailer immediately before the mailer newly created the executable file (Malware.exe), and Extract the mail reception log that matches the MessageID described in the mail open log. Furthermore, the virus intrusion route searching unit 222 specifies the other client device 10b that has transmitted the mail by extracting the sender mail address 1701 recorded in the record of the found operation history.

Also, the virus intrusion route searching unit 222 may specify another client device 10b that has transmitted the target mail by using both (iii-i) and (iii-ii) in combination.

Note that (i) to (iii-ii) may be executed in the client device 10a that has detected a virus.

(Iv) Based on the sender email address 1701 and the attached file name 604, the virus intrusion route searching unit 222 searches the database 224 for a record of operation history indicating that the attached file in question has been received, and extracts it. The virus intrusion route searching unit 222 extracts the sender e-mail address 1701 contained in the record, thereby specifying the other client device 10c that has sent the e-mail.

(V) Based on the sender email address 1701 and the attached file name 604, the virus intrusion route searching unit 222 searches the database 224 for a record of operation history indicating that the attached file in question has been received and extracts it. The virus intrusion route search unit 222 specifies the external sender (unknown@malware.jp) that has sent the mail by extracting the sender mail address 1701 included in the record. The first entry into the management of the server device 20 is identified as the client device 10c.

FIG. 18 is a flowchart showing the backtrace procedure. The client device that has detected the virus executes S1801 to S1803, and the server device 20 executes S1804 to S1807.

In step S1801, the virus intrusion route searching unit 202 identifies that the process that created the executable file of the virus is a mailer based on the virus detection information and the operation history 600.

In S1802, the virus intrusion route searching unit 202 searches the database 204 for the operation history related to the mailer and extracts it, and specifies the sender address that has transmitted the attached file related to the virus.

In step S1803, the virus intrusion route searching unit 202 determines whether to request the server device 20 to search based on whether the sender address is an address within the same domain or an address outside the same domain. If the sender address is out of the same domain, the backtrace is ended because the entry point is identified there. On the other hand, if the sender address is an address within the same domain, backtrace can be continued from the database 224 of the server device 20. Therefore, if the sender address is an address in the same domain, the process proceeds to S1804.

In S1804, the virus intrusion route searching unit 222 of the server device 20 searches the database 224 based on the attached file name attached to the search request from the client device 10, and extracts the operation history of receiving the attached file.

In step S1805, the virus intrusion route searching unit 222 transmits a terminal (client file that has transmitted an attached file) that may hold a virus based on the email address information (sender address 1701) of the operation history that has been found. Identify.

In step S1806, the virus intrusion route searching unit 222 determines whether to backtrace the operation history of the other client device based on the address information of the terminal that may hold the virus. If the address of a terminal which may hold a virus is an address within the same domain, the database 224 stores its operation history. Therefore, the virus intrusion route searching unit 222 proceeds to S1807 to execute a search further. In S1807, the virus intrusion route searching unit 222 executes S1804 to S1806. By repeatedly executing S1804 to S1807, the virus intrusion route searching unit 222 specifies the sender (client terminal) that has first transmitted the attached file related to the virus in the same domain. As described above, the client terminal having received the mail with the attached file from the outside and transferred it to another address in the same domain is specified. On the other hand, if the address of the terminal which may hold the virus is an address outside the same domain, the intrusion can be identified, and the back trace is ended.

● [Case where viruses move among multiple client devices by removable device]
As mentioned above, removable devices such as USB memory can be used between multiple client devices. Thus, files physically associated with viruses may be transported via removable devices. When a virus is detected from a file read from a removable device by any client device, it may be meaningful to identify which removable device writes the file to which client device.

FIG. 19 shows that the client device 10b writes the virus related file (Malware.doc) to the removable device 18 attached (connected) to the client device 10b. Furthermore, the removable device 18 is connected to another client device 10a, and virus related files are copied to the storage device of the client device 10a to 15 or opened by the CPU 11. As a result, the virus detection unit 203 detects that the virus related file (Malware.doc) includes a virus code.

FIG. 20 shows an example of the back trace.

(I) The virus detection unit 203 detects that the document editing software (wordproc.exe) has executed the virus code. The virus intrusion route search unit 202 receives virus detection information (process name) received by the virus detection unit 203 in order to search for an operation history indicating that the document editing software (wordproc.exe), which is a process related to the virus, has been activated. 603, the database 204 is searched based on the process ID 1202). As a result, the virus intrusion route searching unit 202 finds a record of an operation history indicating that a process related to the virus has started.

(Ii) When the virus intrusion route searching unit 202 finds the operation history when the process starts, it detects the process from the time when the process started to the time when the virus is detected among the records having common process identification information. Identify the operation history record that indicates that some file has been opened. When the virus intrusion route searching unit 202 finds the record, the virus intrusion route searching unit 202 acquires the path name (Malware.doc) of the file opened from the record. The virus intrusion route searching unit 202 recognizes that the drive letter included in the path name is a drive letter assigned to the removable device.

(Iii) The virus intrusion route searching unit 202 searches the database 204 for a record of operation history indicating that the removable device to which the drive letter "F:" is assigned is attached and extracts it.

(Iv) The virus intrusion route searching unit 202 extracts identification information (for example, vendor ID 2002, product ID 2003, serial ID) of the removable device from the found record. Furthermore, the virus intrusion route searching unit 202 transmits the extracted identification information of the removable device and the path name (Malware.doc) of the virus related file to the server device 20 along with the search request.

(V) When the search request is received, the virus intrusion route search unit 222 of the server device 20 searches the database 224 based on the identification information of the removable device 18, and identifies the record of the operation history to which the removable device 18 is attached. . At this stage, it can be known to which client device the removable device 18 has been connected. Furthermore, the virus intrusion route searching unit 222 identifies the drive letter assigned to the removable device 18 from the record, adds the drive letter to the pathname of the virus related file (Malware.doc), and decides the pathname (D: \ Malware). Create .doc), search and extract records of operation history including the created path name. In this example, it is found that the file in question has been written to the removable device by the file management software (filemanager.exe) on the client device 10b.

In addition, the search process of the penetration path | route after this is as having already demonstrated.

FIG. 21 is a flowchart showing the backtrace procedure.

In step S <b> 2101, the virus intrusion route searching unit 202 identifies that the virus has passed through the removable device 18 from the path name of the file recorded in the operation history 600.

In step S2102, the virus intrusion route searching unit 202 extracts identification information (for example, vendor ID 2002, product ID 2003, serial ID) of the removable device 18 from the operation history 600.

In step S2103, the virus intrusion route searching unit 202 determines whether or not the server device 20 performs a search. For example, when the server device 20 holds the operation history of a plurality of terminal devices, it is determined that the server executes a search. If it is determined that the server device 20 does not execute the process, the backtrace is ended. If it is determined that the server device 20 should execute the process, a search request is transmitted to the server device 20, and the process proceeds to S2104.

In S2104, the virus intrusion route searching unit 222 of the server device 20 operates the operation history record in which the virus file is stored in the removable device from the identification information of the removable device and the path name of the virus file attached to the received search request. It identifies from the database 224.

In step S2105, the virus intrusion route searching unit 222 identifies the client device holding the virus from the PC name included in the record of the found operation history.

In step S2106, the virus intrusion route searching unit 222 determines whether to further specify the operation history of the client device holding the virus. For example, when the administrator of the server device 20 instructs execution, the process proceeds to S2107, and the virus intrusion route searching unit 222 further specifies an intrusion route. This makes it possible to identify whether the virus file is mail or a website.

● [Refine when backtrace finds two or more intrusion routes]
As described above, when the backtrace is performed, the process often opens a plurality of files after the process is started until a virus is detected. In this case, the backtrace results in multiples, and it can not be identified which file is the file associated with the virus.

Therefore, in the present embodiment, the virus intrusion route searching unit 202 specifies a file operated from the start of the process to the detection of the virus based on the process identification information of the process in which the virus is detected, When a plurality of files are identified, weighting is performed on the plurality of files to narrow down one file associated with the virus entry route.

The weighting includes, for example, the date and time when the file was operated, the execution result of the file, virus information provided on the network as a result of performing virus detection on the file, and information input by the user. May be performed according to at least one of Further, the process of determining the weighting may be performed based on provision of information from an external system.

FIG. 23 is a flowchart showing the backtrace procedure. This flowchart may be executed by the client device 10 or may be executed by the server device 20. Here, it is assumed that the client device 10 executes.

In S2301, the virus intrusion route searching unit 202 executes backtrace.

In S2302, the virus intrusion route searching unit 202 determines whether or not the backtrace execution result is two or more. When a plurality of execution results are obtained, the processing proceeds to S2303, and when one execution result is obtained, the processing proceeds to S2305, and the execution results are transmitted to the server device 20.

In step S2303, the virus intrusion route searching unit 202 determines whether to perform weighting. For example, the administrator inputs whether or not to weight using a keyboard or pointing device. If weighting is not performed, the process advances to step S2305 to notify the server device 20 of a plurality of execution results. On the other hand, when weighting is performed, the processing proceeds to step S2304.

In S2304, the virus intrusion route searching unit 202 narrows down to one execution result related to the virus intrusion route by executing weighting on the plurality of execution results. The weighting is performed, for example, according to at least one of the date and time when the file is operated, the execution result of the file, the result of performing virus detection on the file, and the information input by the user. It is also good.

FIG. 24 is a flowchart showing the weighting process performed by the server device 20.

In S2401, the virus intrusion route searching unit 222 acquires the result of backtrace from the client device 10.

In S2402, the virus intrusion route searching unit 222 determines the number N to be searched from the acquired backtrace result. First, the number of backtrace results is assigned to N.

In S2403, the virus intrusion route searching unit 222 determines whether the number N to be searched has become zero. If it is not zero, the process proceeds to S2404.

In S2404, the virus intrusion route searching unit 222 arbitrarily extracts one search target from the N search targets.

In S2405, the virus intrusion route searching unit 222 performs backtrace on the extracted search object using the operation history database 224.

In S2406, the virus intrusion route searching unit 222 writes the result of the backtrace in the storage device 25.

In S2407, the virus intrusion route searching unit 222 deletes the search object searched this time from the N search objects, and further subtracts N by one. Thereafter, the process returns to S2401.

If N becomes zero in S2403, the process advances to S2408.

In S2408, the virus intrusion route searching unit 222 analyzes the recorded result and executes weighting.

In step S2409, the client apparatus 10 is notified of the backtrace result identified by the weighting.

As described above, according to the present embodiment, there is provided a virus intrusion route specifying device that backtraces the virus intrusion route to the terminal device. The operation history databases 204 and 224 function as an operation history storage unit that stores an operation history that is a history of operations performed on the terminal device. When a virus is detected in the terminal device, the virus intrusion route searching unit 202, 222 specifies the date when the virus was first stored in the terminal device from the operation history stored in the operation history storage means, and It functions as a specifying means for specifying the virus entry route from the contents of the operation executed at the specified date and time. According to the present invention, by using the operation history, it is possible to backtrace the viral infection route in more detail than in the past.

Further, according to the present embodiment, the virus intrusion route specifying device may be provided in the client device 10 or in the server device 20. If provided in the client device 10, the intrusion route can be identified even in a stand-alone environment. If the server device 20 is provided, the load due to the specific process of the client device 10 can be reduced.

In addition, the client device 10 transmits, to the server device, a request for specifying the virus detection unit 203 that functions as a virus detection unit that detects a virus, and a virus intrusion route detected by the virus detection unit. The agent service 201 functioning as a request transmission unit and the virus intrusion route search unit 202 may be provided. Not only can the load on the client device 10 be reduced, it will be possible to specify the path in more detail in the server device.

The virus intrusion path specifying device may be provided in the client device 10 and also in the server device 20 connected to the client device 10. The virus intrusion route identifying device provided in the client device 10 and the virus intrusion route identifying device provided in the server device 20 may cooperate to identify the virus intrusion route to the terminal device. This allows the load to be distributed. Also, the operation history stored in the client device 10 can be reduced.

The client device 10 transfers the operation history stored in the operation history storage means of the client device 10 for storage in the server device, and operation history management means for deleting all or part of the transferred operation history, and identification When the means can not identify the virus intrusion route from the operation history stored in the operation history storage unit, a request for requesting to specify the virus intrusion route from the operation history stored in the server device It may further include an agent service 201 and a virus intrusion route searching unit 202 that function as a request transmission unit that transmits the request to the server device.

Further, the virus intrusion route searching units 202 and 222 determine whether the content of the operation included in each record constituting the operation history is a specific operation content to be executed when the virus invades, The entry point where the virus has invaded the terminal device may be identified.

Also, the virus entry route searching unit 202, 222 may specify the entry route of the virus by searching the operation history also for the parent process that has called the child process involved in the storage of the virus.

In the operation history storage means (database 224) provided in the server device 20, the operation history extending over the period of the operation history stored in the operation history storage means (database 204) provided in the client device 10 is longer It may be stored.

Further, the specifying unit (virus intrusion route searching unit 222) provided in the server device 20 is acquired in a period further past the period investigated by the specifying unit (virus intrusion route searching unit 202) provided in the terminal device. The virus entry route may be specified for the operation history.

Further, the operation history storage means provided in the server device 20 stores the operation history acquired in the plurality of terminal devices, and the identification means provided in the server device 20 is one of the plurality of terminal devices. When a virus is found in one terminal device, operation histories of a plurality of terminal devices may be searched based on a path name or process identification information associated with the virus to specify an intrusion route of the virus.

In addition, the virus intrusion route searching unit 202, 222 stores the operation pathname of the file operated from the time the process is started until the virus is detected based on the process identification information of the process in which the virus is detected The terminal device that has provided the file may be identified based on the path name found by the search.

In addition, the virus intrusion route searching unit 202, 222 stores the operation pathname of the file operated from the time the process is started until the virus is detected based on the process identification information of the process in which the virus is detected The process itself may be identified as a virus if a file operated by the process is not found until the virus is detected after the process is started.

Also, the virus intrusion route searching unit 202, 222 identifies another process that has created the executable file of the process based on the process identification information of the process in which the virus is detected, and determines whether the other process is a mailer. To identify an operation history indicating that the mailer has received an email attached the execution file of the process, identify the sender of the email based on the operation history, and indicate that the sender forwarded the email The operation history to be shown may be specified, the sender who transferred the email may specify an operation history indicating that another sender has received the email, and the intrusion route of the virus may be identified based on the operation history. .

Also, the virus intrusion route searching unit 202, 222 specifies the path name of the file operated by the process based on the process identification information of the process in which the virus is detected, and the file is removable based on the path name of the file An operation history indicating that the device has been stored is specified, identification information of the removable device is specified from the operation history, and another terminal device to which the removable device has been connected based on the identification information of the removable device May be specified, and the invasion route of the virus may be specified from the operation history of the other terminal device.

Also, if the detected virus has already been uploaded to the website, the virus intrusion route searching unit 202, 222 refers to the virus, identifies the URL of the website based on the uploaded process, and enters the virus Paths and diffusion paths may be identified.

In addition, when the detected virus is attached to the mail and sent, the virus intrusion route searching unit 202, 222 refers to the virus and sends mail information such as MessageID, From, To of the mail from the attached process. It may be identified to identify the virus diffusion route or entry route.

Moreover, the virus detected by the terminal device holding the virus intrusion route searching units 202 and 222 may be a file created in the terminal device from another terminal device by file sharing. In this case, it may not be possible to specify which terminal device has created the virus by only the operation history of the terminal device. In that case, the virus intrusion route searching units 202 and 222 may acquire the operation history of the other terminal device participating in or participating in the file sharing, and specify the virus intrusion route from the operation history.

Also, if the process that created the detected virus refers to the ZIP file, the virus intrusion route searching unit 202, 222 extracts the file created by extracting the ZIP file, and the virus intrusion detection unit 202, 222 The virus intrusion route may be specified by tying the virus detected by.

When the process involved in the detected virus refers to a plurality of ZIP files, the virus intrusion route searching unit 202, 222 performs weighting on the plurality of ZIP files to obtain It may be configured to narrow down one file related to the intrusion route.

As an example of weighting, a method may be adopted in which a large weight is given to the ZIP file referred to immediately before the time when the virus file was newly created, and other weighting may be used (for example, The date and time when the file is operated, the execution result of the file, the result of executing virus detection on the file, and the information input by the user may be executed. This narrows down one file associated with the virus entry route. Thus, the ZIP file referenced at the time closest to the time when the virus file was newly created will be given the largest weight.

Also, even when the target virus file is compressed by ZIP, the virus intrusion route searching units 202 and 222 may similarly identify the ZIP file including the corresponding virus file, and may specify the virus route.

Also, the virus intrusion route searching unit 202, 222 specifies a file operated from the time the process starts up to the time the virus is detected based on the process identification information of the process in which the virus is detected, and a plurality of files When is identified, weighting may be performed on the plurality of files to narrow down one file associated with the virus entry route.

The weighting is performed according to at least one of the date and time when the file is operated, the execution result of the file, the result of performing virus detection on the file, and the information input by the user. It is also good.

When one or more results (invasion routes) are specified by the virus entry route searching unit 202, 222, the virus entry route searching unit 202, 222 takes account of the result alone, or considers a combination. The weight may be set to the result.

Also, when the anti-virus software (virus detection unit 203) detects a virus, the client device automatically notifies the virus intrusion route search unit 202 of the result, regardless of the notification, a client device in which the virus is detected manually, Alternatively, the virus information may be notified to the virus intrusion route searching unit 222 existing on the server that manages the client apparatus, and the back trace may be performed at an arbitrary timing.

The various means described above may be realized by a computer executing a program. In addition, operations of the client device and the server device may be restricted based on the result of the backtrace. For example, if it is determined from the back trace result that the virus is downloaded when browsing a specific website, the agent service 201 or the management unit 225 prohibits access to the website, and Also limit or prohibit the action against the virus. This makes it possible to prevent attacks from viruses in advance.

Also, the agent service 201 or the management unit 225 may isolate or delete the file determined to be a virus.

Further, the virus detection unit 203 may transmit a file determined to be a virus to the management unit 225, and the management unit 225 may collect the file, or a server provided outside the management unit 225 may collect it. .

The present invention is not limited to the above embodiment, and various changes and modifications can be made without departing from the spirit and scope of the present invention. Accordingly, the following claims are attached to disclose the scope of the present invention.

The present application claims priority based on Japanese Patent Application No. 2012-268785 filed on Dec. 7, 2012, the entire contents of which are incorporated herein by reference.

Claims (20)

  1. What is claimed is: 1. A virus intrusion route specifying device that backtraces a virus intrusion route to a terminal device, comprising:
    Operation history storage means for storing an operation history which is a history of an operation performed on the terminal device;
    When a virus is detected in the terminal device, the date and time when the virus is first stored in the terminal device is specified from the operation history stored in the operation history storage means, and executed at the specified date and time And a specifying means for specifying the virus entry route from the contents of the operation.
  2. The virus entry route identification device according to claim 1, wherein the virus entry route identification device is provided in the terminal device.
  3. The virus intrusion route identifying device according to claim 1, wherein the virus intrusion route identifying device is provided in a server device connected to the terminal device.
  4. The terminal device is
    Virus detection means for detecting a virus;
    4. The virus intrusion route specification according to claim 3, further comprising: request transmission means for transmitting to the server device a request for specifying the virus entry route detected by the virus detection unit. apparatus.
  5. The virus intrusion route specifying device is provided in the terminal device, and is also provided in a server device connected to the terminal device, and the virus intrusion route specifying device provided in the terminal device, and the server The virus entry route identifying apparatus according to claim 1, wherein the virus entry route identifying apparatus provided in the apparatus cooperates with the virus entry route identifying apparatus to identify a virus entry route to the terminal apparatus.
  6. The terminal device is
    Operation history management means for transferring the operation history stored in the operation history storage means of the terminal device for storing in the server device, and deleting all or part of the transferred operation history;
    When the specifying unit can not specify the virus intrusion route from the operation history stored in the operation history storage unit, it specifies the virus intrusion route from the operation history stored in the server device. 6. The virus intrusion route specifying device according to claim 5, further comprising: request transmission means for transmitting a request for making a request to the server device.
  7. The specifying unit determines whether the content of the operation included in each record constituting the operation history is a specific operation content to be executed when a virus invades, whereby the virus causes the terminal device to The virus intrusion route specifying device according to any one of claims 1 to 6, characterized in that an intrusion entrance which has invaded is identified.
  8. The method according to any one of claims 1 to 5, wherein the specifying means specifies an intrusion route of the virus by searching from the operation history also for a parent process that has called a child process involved in storing the virus. The virus entry route identification device according to claim 1.
  9. In the operation history storage means provided in the server device, an operation history extending over a period longer than the operation history period stored in the operation history storage means provided in the terminal device is stored. The virus entry route identification device according to claim 5, characterized in that:
  10. The specifying means provided in the server device is characterized by specifying an intrusion route of the virus with respect to an operation history acquired in a period further past a period investigated by the specifying means provided in the terminal device. The virus entry route identification device according to claim 9.
  11. The operation history storage means provided in the server device stores operation histories acquired in a plurality of terminal devices,
    When the virus is found in one of the plurality of terminal devices, the specifying unit provided in the server device determines the plurality of terminals based on the path name or process identification information associated with the virus. The virus intrusion route specifying device according to claim 5 or 6, wherein an operation history of the device is searched to identify an intrusion route of the virus.
  12. The specifying means searches the operation history storage means for searching for a path name of a file operated from the time the process is started until the virus is detected based on the process identification information of the process in which the virus is detected. The virus intrusion route specifying device according to any one of claims 1 to 11, characterized in that a terminal device which provided the file is specified based on a path name found by the.
  13. The specifying means searches the operation history storage means for the path name of the file operated from the start of the process to the detection of the virus based on the process identification information of the process in which the virus is detected. The process according to any one of claims 1 to 12, wherein when the file operated is not found between the time the process is started and the virus is detected, the process itself is identified as a virus. The virus entry route identification device as described.
  14. The identification means identifies another process that has created the executable file of the process based on the process identification information of the process in which the virus is detected, determines whether the other process is a mailer, and the mailer determines the process Specifying an operation history indicating that the email attached with the execution file is received, identifying a sender of the email based on the operation history, and identifying an operation history indicating that the sender forwarded the email The sender who transferred the mail identifies an operation history indicating that another sender has received the mail, and the intrusion route of the virus is identified based on the operation history. The virus entry route identification device according to claim 1.
  15. The specifying means specifies the path name of the file operated by the process based on the process identification information of the process in which the virus is detected, and the file is stored in the removable device based on the path name of the file Identify the identification information of the removable device from the operation history, identify another terminal device to which the removable device has been connected, from the identification information of the removable device, and 7. The virus intrusion route specifying device according to claim 5, wherein the virus intrusion route is specified from an operation history of a terminal device.
  16. The specifying means specifies a file operated from the time the process is activated until the virus is detected based on process identification information of the process in which the virus is detected, and when a plurality of files are specified, The virus intrusion route specification according to any one of claims 1 to 15, wherein one file related to the virus entry route is narrowed down by performing weighting on the plurality of files. apparatus.
  17. The weighting is performed according to at least one of date and time when the file is operated, execution result of the file, result of performing virus detection on the file, and information input by the user The virus entry route identification device according to claim 16, characterized in that:
  18. The virus intrusion route identifying apparatus according to any one of claims 1 to 15, wherein the identification unit identifies the diffusion route of the virus from the operation history stored in the operation history unit. .
  19. A virus intrusion route identification method for backtracing a virus entry route to a terminal device, comprising:
    An operation history storage step of storing an operation history, which is a history of an operation performed on the terminal device, in an operation history storage unit;
    When a virus is detected in the terminal device, the date and time when the virus is first stored in the terminal device is specified from the operation history stored in the operation history storage means, and executed at the specified date and time And v. Identifying the entry route of the virus from the contents of the operation.
  20. A program that causes a computer to execute a virus intrusion route specifying process for backtracing a virus intrusion route to a terminal device,
    On that computer,
    Operation history storage means for storing an operation history which is a history of an operation performed on the terminal device;
    When a virus is detected in the terminal device, the date and time when the virus is first stored in the terminal device is specified from the operation history stored in the operation history storage means, and executed at the specified date and time A program characterized in that it functions as specifying means for specifying an intrusion route of the virus from contents of operation.
PCT/JP2013/006842 2012-12-07 2013-11-21 Virus intrusion route identification device, virus intrusion route identification method and program WO2014087597A1 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
JP2012-268785 2012-12-07
JP2012268785 2012-12-07

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
JP2014550901A JP6590481B2 (en) 2012-12-07 2013-11-21 Virus intrusion route specifying device, virus intrusion route specifying method and program
US14/723,898 US10326792B2 (en) 2012-12-07 2015-05-28 Virus intrusion route identification device, virus intrusion route identification method, and program

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US14/723,898 Continuation US10326792B2 (en) 2012-12-07 2015-05-28 Virus intrusion route identification device, virus intrusion route identification method, and program

Publications (1)

Publication Number Publication Date
WO2014087597A1 true WO2014087597A1 (en) 2014-06-12

Family

ID=50883039

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2013/006842 WO2014087597A1 (en) 2012-12-07 2013-11-21 Virus intrusion route identification device, virus intrusion route identification method and program

Country Status (3)

Country Link
US (1) US10326792B2 (en)
JP (2) JP6590481B2 (en)
WO (1) WO2014087597A1 (en)

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2016072310A1 (en) * 2014-11-05 2016-05-12 キヤノン電子株式会社 Specification device, control method thereof, and program
JP2016181191A (en) * 2015-03-25 2016-10-13 富士通株式会社 Management program, management unit and management method
JP2016218984A (en) * 2015-05-26 2016-12-22 日本電信電話株式会社 Log determining device, log determining method, and log determining program
JP2016218788A (en) * 2015-05-21 2016-12-22 日本電信電話株式会社 Log extraction system, log extraction method, and log extraction program
CN106796635A (en) * 2014-10-14 2017-05-31 日本电信电话株式会社 Determining device, determine method and determination program
WO2017175283A1 (en) * 2016-04-04 2017-10-12 三菱電機株式会社 Process search device and process search program
US10326792B2 (en) 2012-12-07 2019-06-18 Canon Denshi Kabushiki Kaisha Virus intrusion route identification device, virus intrusion route identification method, and program

Families Citing this family (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE102014201908A1 (en) * 2014-02-03 2015-08-06 Duerr Cyplan Ltd. Method for guiding a fluid flow, flow apparatus and its use
US9553885B2 (en) * 2015-06-08 2017-01-24 Illusive Networks Ltd. System and method for creation, deployment and management of augmented attacker map
US10382484B2 (en) 2015-06-08 2019-08-13 Illusive Networks Ltd. Detecting attackers who target containerized clusters
US9967273B2 (en) * 2015-06-15 2018-05-08 Microsoft Technology Licensing, Llc. Abusive traffic detection
US10462160B2 (en) * 2015-12-09 2019-10-29 Check Point Software Technologies Ltd. Method and system for identifying uncorrelated suspicious events during an attack
US10440036B2 (en) * 2015-12-09 2019-10-08 Checkpoint Software Technologies Ltd Method and system for modeling all operations and executions of an attack and malicious process entry
US20170171224A1 (en) * 2015-12-09 2017-06-15 Checkpoint Software Technologies Ltd. Method and System for Determining Initial Execution of an Attack
US10291634B2 (en) 2015-12-09 2019-05-14 Checkpoint Software Technologies Ltd. System and method for determining summary events of an attack
JP2017138860A (en) * 2016-02-04 2017-08-10 富士通株式会社 Safety determination device, safety determination program, and safety determination method
US10200374B1 (en) * 2016-02-29 2019-02-05 Symantec Corporation Techniques for detecting malicious files
US9928366B2 (en) 2016-04-15 2018-03-27 Sophos Limited Endpoint malware detection using an event graph
US9967267B2 (en) * 2016-04-15 2018-05-08 Sophos Limited Forensic analysis of computing activity
JP2018032354A (en) 2016-08-26 2018-03-01 富士通株式会社 Program, method, and device for assisting cyberattack analysis
TWI648650B (en) * 2017-07-20 2019-01-21 中華電信股份有限公司 Gateway device and method for detecting a malicious hack host domain and receiving non-transitory computer readable medium
US10404747B1 (en) 2018-07-24 2019-09-03 Illusive Networks Ltd. Detecting malicious activity by using endemic network hosts as decoys
US10382483B1 (en) 2018-08-02 2019-08-13 Illusive Networks Ltd. User-customized deceptions and their deployment in networks
US10333977B1 (en) * 2018-08-23 2019-06-25 Illusive Networks Ltd. Deceiving an attacker who is harvesting credentials
US10432665B1 (en) 2018-09-03 2019-10-01 Illusive Networks Ltd. Creating, managing and deploying deceptions on mobile devices

Citations (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH0944432A (en) * 1995-05-24 1997-02-14 Fuji Xerox Co Ltd Information processing method and information processor
JPH11134190A (en) * 1997-10-31 1999-05-21 Hitachi Ltd System and method for detecting and reporting virus and storage medium stored with program regarding same method
JP2004086241A (en) * 2002-08-22 2004-03-18 Hitachi Information Systems Ltd Computer virus infection source detection system
JP2005025378A (en) * 2003-06-30 2005-01-27 Nidek Co Ltd Computer virus detection method and network system using this method
US20070006310A1 (en) * 2005-06-30 2007-01-04 Piccard Paul L Systems and methods for identifying malware distribution sites
US20070250818A1 (en) * 2006-04-20 2007-10-25 Boney Matthew L Backwards researching existing pestware
US20070250817A1 (en) * 2006-04-20 2007-10-25 Boney Matthew L Backwards researching activity indicative of pestware
US20070250928A1 (en) * 2006-04-20 2007-10-25 Boney Matthew L Backward researching time stamped events to find an origin of pestware
JP2009176132A (en) * 2008-01-25 2009-08-06 Sky Co Ltd Virus suffering range prediction system
JP2012198796A (en) * 2011-03-22 2012-10-18 Nec Corp Log collection system, device, method and program

Family Cites Families (28)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH06110718A (en) 1992-09-30 1994-04-22 Toshiba Corp Virus protection system
JP2002287991A (en) 2001-03-26 2002-10-04 Fujitsu Ltd Computer virus infection information providing method, and computer virus infection information providing system
US7111000B2 (en) * 2003-01-06 2006-09-19 Microsoft Corporation Retrieval of structured documents
JP3912676B2 (en) * 2003-02-27 2007-05-09 ソニー株式会社 Recording device, file management method, file management method program, and recording medium recording file management method program
US7937758B2 (en) * 2006-01-25 2011-05-03 Symantec Corporation File origin determination
JP2008052570A (en) 2006-08-25 2008-03-06 Hitachi Software Eng Co Ltd System for managing operation history
US7797335B2 (en) 2007-01-18 2010-09-14 International Business Machines Corporation Creation and persistence of action metadata
KR100922582B1 (en) * 2007-07-20 2009-10-21 한국전자통신연구원 Log-based traceback system and method by using the centroid decomposition technique
US8745703B2 (en) * 2008-06-24 2014-06-03 Microsoft Corporation Identifying exploitation of vulnerabilities using error report
US8695094B2 (en) 2008-06-24 2014-04-08 International Business Machines Corporation Detecting secondary infections in virus scanning
US20110029819A1 (en) * 2009-07-31 2011-02-03 Virendra Kumar Mehta System and method for providing program tracking information
JP4788808B2 (en) * 2009-08-06 2011-10-05 コニカミノルタビジネステクノロジーズ株式会社 Job processing system, image processing apparatus, virus detection method, and virus detection program
US8190647B1 (en) * 2009-09-15 2012-05-29 Symantec Corporation Decision tree induction that is sensitive to attribute computational complexity
US9124616B2 (en) 2010-04-02 2015-09-01 Hitachi, Ltd. Computer system management method and client computer
US8413244B1 (en) * 2010-11-11 2013-04-02 Symantec Corporation Using temporal attributes to detect malware
US9038176B2 (en) * 2011-03-31 2015-05-19 Mcafee, Inc. System and method for below-operating system trapping and securing loading of code into memory
US8627465B2 (en) * 2011-04-18 2014-01-07 International Business Machines Corporation Automatic inference of whitelist-based validation as part of static analysis for security
US20140351936A1 (en) * 2011-12-19 2014-11-27 Beijing Rising Information Technology Co., Ltd. Frequency-variable anti-virus technology
US20130312099A1 (en) * 2012-05-21 2013-11-21 Mcafee, Inc. Realtime Kernel Object Table and Type Protection
US9767280B2 (en) 2012-10-09 2017-09-19 Canon Denshi Kabushiki Kaisha Information processing apparatus, method of controlling the same, information processing system, and information processing method
US9275223B2 (en) * 2012-10-19 2016-03-01 Mcafee, Inc. Real-time module protection
WO2014087597A1 (en) 2012-12-07 2014-06-12 キヤノン電子株式会社 Virus intrusion route identification device, virus intrusion route identification method and program
US10409980B2 (en) 2012-12-27 2019-09-10 Crowdstrike, Inc. Real-time representation of security-relevant system state
WO2014116888A1 (en) * 2013-01-25 2014-07-31 REMTCS Inc. Network security system, method, and apparatus
JP6352140B2 (en) * 2013-10-22 2018-07-04 キヤノン電子株式会社 Web system, server switching device, server switching method and program
US9471912B2 (en) * 2014-02-06 2016-10-18 Verto Analytics Oy Behavioral event measurement system and related method
JP6461992B2 (en) 2014-11-05 2019-01-30 キヤノン電子株式会社 Specific device, control method thereof, and program
KR101676366B1 (en) * 2016-06-23 2016-11-15 국방과학연구소 Attacks tracking system and method for tracking malware path and behaviors for the defense against cyber attacks

Patent Citations (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH0944432A (en) * 1995-05-24 1997-02-14 Fuji Xerox Co Ltd Information processing method and information processor
JPH11134190A (en) * 1997-10-31 1999-05-21 Hitachi Ltd System and method for detecting and reporting virus and storage medium stored with program regarding same method
JP2004086241A (en) * 2002-08-22 2004-03-18 Hitachi Information Systems Ltd Computer virus infection source detection system
JP2005025378A (en) * 2003-06-30 2005-01-27 Nidek Co Ltd Computer virus detection method and network system using this method
US20070006310A1 (en) * 2005-06-30 2007-01-04 Piccard Paul L Systems and methods for identifying malware distribution sites
US20070250818A1 (en) * 2006-04-20 2007-10-25 Boney Matthew L Backwards researching existing pestware
US20070250817A1 (en) * 2006-04-20 2007-10-25 Boney Matthew L Backwards researching activity indicative of pestware
US20070250928A1 (en) * 2006-04-20 2007-10-25 Boney Matthew L Backward researching time stamped events to find an origin of pestware
JP2009176132A (en) * 2008-01-25 2009-08-06 Sky Co Ltd Virus suffering range prediction system
JP2012198796A (en) * 2011-03-22 2012-10-18 Nec Corp Log collection system, device, method and program

Cited By (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10326792B2 (en) 2012-12-07 2019-06-18 Canon Denshi Kabushiki Kaisha Virus intrusion route identification device, virus intrusion route identification method, and program
EP3200115A4 (en) * 2014-10-14 2017-10-04 Nippon Telegraph and Telephone Corporation Specification device, specification method, and specification program
CN106796635B (en) * 2014-10-14 2019-10-22 日本电信电话株式会社 Determining device determines method
US10397261B2 (en) 2014-10-14 2019-08-27 Nippon Telegraph And Telephone Corporation Identifying device, identifying method and identifying program
CN106796635A (en) * 2014-10-14 2017-05-31 日本电信电话株式会社 Determining device, determine method and determination program
WO2016072310A1 (en) * 2014-11-05 2016-05-12 キヤノン電子株式会社 Specification device, control method thereof, and program
JPWO2016072310A1 (en) * 2014-11-05 2017-08-17 キヤノン電子株式会社 Specific device, control method thereof, and program
US10382477B2 (en) 2014-11-05 2019-08-13 Canon Denshi Kabushiki Kaisha Identification apparatus, control method therefor, and storage medium
JP2016181191A (en) * 2015-03-25 2016-10-13 富士通株式会社 Management program, management unit and management method
JP2016218788A (en) * 2015-05-21 2016-12-22 日本電信電話株式会社 Log extraction system, log extraction method, and log extraction program
JP2016218984A (en) * 2015-05-26 2016-12-22 日本電信電話株式会社 Log determining device, log determining method, and log determining program
WO2017175283A1 (en) * 2016-04-04 2017-10-12 三菱電機株式会社 Process search device and process search program
GB2563530A (en) * 2016-04-04 2018-12-19 Mitsubishi Electric Corp Process search device and procss search program
JPWO2017175283A1 (en) * 2016-04-04 2018-08-30 三菱電機株式会社 Process search device and process search program
GB2563530B (en) * 2016-04-04 2019-12-18 Mitsubishi Electric Corp Process search apparatus and process search program

Also Published As

Publication number Publication date
JP6590481B2 (en) 2019-10-16
JPWO2014087597A1 (en) 2017-01-05
US10326792B2 (en) 2019-06-18
US20150264062A1 (en) 2015-09-17
JP6549767B2 (en) 2019-07-24
JP2018185860A (en) 2018-11-22

Similar Documents

Publication Publication Date Title
US10218740B1 (en) Fuzzy hash of behavioral results
US10121000B1 (en) System and method to detect premium attacks on electronic networks and electronic devices
EP3349414B1 (en) Malicious tunneling handling system
US10516682B2 (en) Forensic analysis of computing activity
AU2012308630B2 (en) Providing a network-accessible malware analysis
US20150180895A1 (en) Apparatus method and medium for tracing the origin of network transmissions using n-gram distribution of data
JP5809084B2 (en) network security system and method
US8185548B2 (en) Techniques and system to deploy policies intelligently
RU2444056C1 (en) System and method of speeding up problem solving by accumulating statistical information
US8943546B1 (en) Method and system for detecting and protecting against potential data loss from unknown applications
US7774363B2 (en) Detecting behavioral patterns and anomalies using information usage data
US20150341378A1 (en) System and Method for Real Time Data Awareness
US9384360B2 (en) Techniques and system for specifying policies using abstractions
US6981279B1 (en) Method and apparatus for replicating and analyzing worm programs
Maggi et al. AndroTotal: a flexible, scalable toolbox and service for testing mobile malware detectors
US20130167236A1 (en) Method and system for automatically generating virus descriptions
US9111069B1 (en) Language detection to improve efficiency of content scanning engine in data loss prevention (DLP) systems
CN101569129B (en) Network security systems and methods
US7636943B2 (en) Method and system for detecting blocking and removing spyware
US9300682B2 (en) Composite analysis of executable content across enterprise network
US9219752B2 (en) Data leak prevention systems and methods
US9825973B2 (en) Website security
AU2011320742B2 (en) Methods for processing private metadata
US8347396B2 (en) Protect sensitive content for human-only consumption
US20140245438A1 (en) Download resource providing method and device

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 13861088

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase in:

Ref document number: 2014550901

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase in:

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 13861088

Country of ref document: EP

Kind code of ref document: A1